@coderifts/agent-guard 4.2.0 → 5.0.0

package/dist/cjs/adapters/gemini.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * Google Gemini function-calling adapter over withCodeRifts (ID632 slice 4 —
+ * same thin pattern as OpenAI / Anthropic / LangGraph).
+ *
+ * Thin SHAPE converter only. Guard logic stays in withCodeRifts; this module:
+ *   1. calls withCodeRifts with the same input shape,
+ *   2. maps ProtectedTool[] → Gemini generateContent tools shape,
+ *   3. returns Gemini-shaped tools PLUS the untouched assurance objects
+ *      (registry_report, composition_assurance, receipt_thread).
+ *
+ * Gemini nesting (differs from OpenAI):
+ *   tools: [ { functionDeclarations: [ { name, description?, parameters }, … ] } ]
+ * One tools entry wraps ALL declarations in a single functionDeclarations array —
+ * not one { type: 'function' } object per tool.
+ *
+ * Honesty (do not "upgrade" assurance):
+ *   - composition_assurance is passed through EXACTLY as the core reported it
+ *     (COMPOSITION_CALL_POLICY_COMPLETE may still be false; inescapable_runtime may be false).
+ *   - The adapter converts tool SHAPE for the model API; it does not claim product-level
+ *     inescapability the core does not claim.
+ *
+ * Only-protected-tools (6/D at the adapter surface):
+ *   - `tools` is derived ONLY from the frozen registry's ProtectedTool list.
+ *   - Raw tools never appear in the returned Gemini table. The host may still hold a raw
+ *     reference outside this table; that boundary stays the host's responsibility.
+ *
+ * Ergonomics (5–10 lines): pass raw tools + client + operation → Gemini-ready tools.
+ * Mirrors src/adapters/openai.ts — only the target tool shape differs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.protectedToolToFunctionDeclaration = protectedToolToFunctionDeclaration;
+exports.toGeminiTools = toGeminiTools;
+exports.withCodeRiftsGemini = withCodeRiftsGemini;
+exports.geminiToolAdapter = geminiToolAdapter;
+const with_coderifts_js_1 = require("../with-coderifts.js");
+/** Empty OpenAPI-like JSON Schema — used when a ProtectedTool has no inputSchema. */
+const EMPTY_PARAMETERS = Object.freeze({
+    type: 'object',
+    properties: {},
+});
+/**
+ * Map one ProtectedTool → Gemini functionDeclaration (shape only; no execute).
+ * Prefer tool.inputSchema when it is a plain object; otherwise empty object schema.
+ */
+function protectedToolToFunctionDeclaration(tool) {
+    const parameters = tool.inputSchema != null
+        && typeof tool.inputSchema === 'object'
+        && !Array.isArray(tool.inputSchema)
+        ? tool.inputSchema
+        : { ...EMPTY_PARAMETERS };
+    const out = {
+        name: tool.name,
+        parameters,
+    };
+    if (tool.description != null && tool.description !== '') {
+        out.description = tool.description;
+    }
+    return out;
+}
+/**
+ * Convert ProtectedTool[] into Gemini `tools` array:
+ *   [ { functionDeclarations: [ … ] } ]
+ *
+ * Empty protected list → empty tools array (no empty wrapper).
+ * Does NOT call the guard — pure shape map over an already-protected list.
+ */
+function toGeminiTools(protectedTools) {
+    if (protectedTools.length === 0)
+        return [];
+    return [{
+            functionDeclarations: protectedTools.map(protectedToolToFunctionDeclaration),
+        }];
+}
+/**
+ * Build Gemini-ready guarded tools from raw tools + client + operation.
+ *
+ * Calls withCodeRifts internally (guard logic stays in the core). Returns:
+ *   - `tools` — Gemini shape [ { functionDeclarations: […] } ]
+ *   - `protected_tools` — same guarded tools for host execute dispatch
+ *   - assurance objects from the core, passed through untouched
+ *
+ * @param input Same shape as withCodeRifts (WithCodeRiftsInput).
+ */
+function withCodeRiftsGemini(input) {
+    const core = (0, with_coderifts_js_1.withCodeRifts)(input);
+    return geminiToolAdapter(core);
+}
+/**
+ * Shape-only adapter over an existing WithCodeRiftsResult (composition style).
+ * Prefer withCodeRiftsGemini when starting from raw tools.
+ *
+ * Does not re-run the guard; does not invent assurance.
+ */
+function geminiToolAdapter(result) {
+    const protected_tools = result.tools;
+    const tools = toGeminiTools(protected_tools);
+    const out = {
+        tools,
+        protected_tools,
+        registry_report: result.registry_report,
+        composition_assurance: result.composition_assurance,
+        receipt_thread: result.receipt_thread,
+    };
+    if (result.repository !== undefined) {
+        out.repository = result.repository;
+    }
+    return out;
+}
+//# sourceMappingURL=gemini.js.map

package/dist/cjs/adapters/gemini.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.js","sourceRoot":"","sources":["../../../src/adapters/gemini.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;AA2EH,gFAgBC;AASD,sCAKC;AAYD,kDAGC;AAQD,8CAcC;AA5ID,4DAAqD;AA+DrD,qFAAqF;AACrF,MAAM,gBAAgB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,kCAAkC,CAAC,IAAmB;IACpE,MAAM,UAAU,GACd,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAE9B,MAAM,GAAG,GAA8B;QACrC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU;KACX,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,cAAwC;IACpE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,CAAC;YACN,oBAAoB,EAAE,cAAc,CAAC,GAAG,CAAC,kCAAkC,CAAC;SAC7E,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CAAC,KAAyB;IAC3D,MAAM,IAAI,GAAwB,IAAA,iCAAa,EAAC,KAAK,CAAC,CAAC;IACvD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,MAA2B;IAC3D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,GAAG,GAA8B;QACrC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cjs/adapters/langgraph.d.ts

@@ -0,0 +1,117 @@
+/**
+ * LangChain / LangGraph tool adapter over withCodeRifts (ID632 slice 3 — same thin
+ * pattern as OpenAI / Anthropic).
+ *
+ * Thin converter only. Guard logic stays in withCodeRifts; this module:
+ *   1. calls withCodeRifts with the same input shape,
+ *   2. maps each ProtectedTool → a framework-agnostic tool descriptor that
+ *      LangChain's tool()/StructuredTool and LangGraph's ToolNode can accept,
+ *   3. returns those descriptors PLUS the untouched assurance objects
+ *      (registry_report, composition_assurance, receipt_thread).
+ *
+ * NO hard dependency on langchain / @langchain/* / langgraph packages. The host
+ * owns the framework import and wires descriptors into tool() / ToolNode /
+ * bind_tools / StateGraph themselves.
+ *
+ * Descriptor shape (dependency-free plain object):
+ *   { name, description?, schema, func, invoke }
+ *   - schema  = JSON Schema from ProtectedTool.inputSchema (or empty object schema)
+ *   - func / invoke = the GUARDED execute (same function reference) — never the raw tool
+ *
+ * Honesty (do not "upgrade" assurance):
+ *   - composition_assurance is passed through EXACTLY as the core reported it
+ *     (COMPOSITION_CALL_POLICY_COMPLETE may still be false; inescapable_runtime may be false).
+ *   - The adapter converts tool shape + binds guarded execute; it does not claim product-level
+ *     inescapability the core does not claim.
+ *
+ * Only-protected-tools (6/D at the adapter surface):
+ *   - `tools` is derived ONLY from the frozen registry's ProtectedTool list.
+ *   - Raw tools never appear in the returned table. The host may still hold a raw
+ *     reference outside this table; that boundary stays the host's responsibility.
+ *
+ * Ergonomics (5–10 lines): pass raw tools + client + operation → LangGraph-ready descriptors.
+ * Mirrors src/adapters/openai.ts and anthropic.ts — only the target tool shape differs.
+ */
+import type { WithCodeRiftsInput, WithCodeRiftsResult, CompositionAssurance, ReceiptThreadHandle } from '../with-coderifts.js';
+import type { ProtectedTool, RegistryCoverageReport } from '../tool-registry.js';
+/**
+ * Framework-agnostic LangChain/LangGraph tool descriptor (no package import).
+ *
+ * Host wiring (illustrative — host supplies the framework packages, e.g.
+ * @langchain/core tools + @langchain/langgraph ToolNode):
+ *   const lcTools = tools.map((d) =>
+ *     hostTool(d.func, { name: d.name, description: d.description, schema: d.schema }));
+ *   // then hostToolNode(lcTools) / hostLlm.bindTools(lcTools)
+ */
+export type LangGraphToolDescriptor = {
+    name: string;
+    description?: string;
+    /** JSON Schema for tool args (LangChain `schema` / StructuredTool args). */
+    schema: Record<string, unknown>;
+    /**
+     * Guarded execute — same as ProtectedTool.execute.
+     * Pass to LangChain `tool(func, …)` or StructuredTool-style runners.
+     */
+    func: (args: unknown) => Promise<unknown>;
+    /**
+     * Alias of `func` for invoke-style APIs (StructuredTool.invoke / ToolNode).
+     * Same guarded execute reference as `func`.
+     */
+    invoke: (args: unknown) => Promise<unknown>;
+};
+/**
+ * Result of withCodeRiftsLangGraph — descriptors + core assurance, unflattened.
+ *
+ * `tools` is the ONLY list intended for the model/runtime tool table. `protected_tools` is the
+ * same guarded list for host inspection — never the raw tools.
+ */
+export type WithCodeRiftsLangGraphResult = {
+    /** LangGraph/LangChain-compatible descriptors — only protected/guarded tools. */
+    tools: LangGraphToolDescriptor[];
+    /**
+     * Guarded ProtectedTool list from withCodeRifts (same tools as `tools`).
+     * Host may use these for dispatch; never raw tools.
+     */
+    protected_tools: ProtectedTool[];
+    /** Untouched registry report — registry's own truth. */
+    registry_report: RegistryCoverageReport;
+    /**
+     * Product-level assurance — deliberately narrower than the registry.
+     * Passed through untouched; may still show inescapable_runtime:false and
+     * residual composition_call_policy_incomplete.
+     */
+    composition_assurance: CompositionAssurance;
+    /** Per-composition receipt cursor — NOT product-truth chain evidence. */
+    receipt_thread: ReceiptThreadHandle;
+    repository?: string;
+};
+/**
+ * Map one ProtectedTool → LangGraph/LangChain tool descriptor.
+ * Binds guarded execute to both `func` and `invoke` (same reference).
+ * Prefer tool.inputSchema when it is a plain object; otherwise empty object schema.
+ */
+export declare function protectedToolToLangGraph(tool: ProtectedTool): LangGraphToolDescriptor;
+/**
+ * Convert a list of ProtectedTool into LangGraph/LangChain descriptors.
+ * Does NOT call the guard — pure map over an already-protected list.
+ */
+export declare function toLangGraphTools(protectedTools: readonly ProtectedTool[]): LangGraphToolDescriptor[];
+/**
+ * Build LangGraph/LangChain-ready guarded tool descriptors from raw tools + client + operation.
+ *
+ * Calls withCodeRifts internally (guard logic stays in the core). Returns:
+ *   - `tools` — plain descriptors { name, description?, schema, func, invoke }
+ *   - `protected_tools` — same guarded tools
+ *   - assurance objects from the core, passed through untouched
+ *
+ * @param input Same shape as withCodeRifts (WithCodeRiftsInput).
+ */
+export declare function withCodeRiftsLangGraph(input: WithCodeRiftsInput): WithCodeRiftsLangGraphResult;
+/**
+ * Shape adapter over an existing WithCodeRiftsResult (composition style).
+ * Prefer withCodeRiftsLangGraph when starting from raw tools.
+ *
+ * Does not re-run the guard; does not invent assurance.
+ */
+export declare function langGraphToolAdapter(result: WithCodeRiftsResult): WithCodeRiftsLangGraphResult;
+//# sourceMappingURL=langgraph.d.ts.map

package/dist/cjs/adapters/langgraph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"langgraph.d.ts","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEjF;;;;;;;;GAQG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;OAGG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C;;;OAGG;IACH,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,iFAAiF;IACjF,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACjC;;;OAGG;IACH,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,wDAAwD;IACxD,eAAe,EAAE,sBAAsB,CAAC;IACxC;;;;OAIG;IACH,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,yEAAyE;IACzE,cAAc,EAAE,mBAAmB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAQF;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,aAAa,GAAG,uBAAuB,CAqBrF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,GAAG,uBAAuB,EAAE,CAEpG;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,4BAA4B,CAG9F;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAG,4BAA4B,CAc9F"}

package/dist/cjs/adapters/langgraph.js

@@ -0,0 +1,113 @@
+"use strict";
+/**
+ * LangChain / LangGraph tool adapter over withCodeRifts (ID632 slice 3 — same thin
+ * pattern as OpenAI / Anthropic).
+ *
+ * Thin converter only. Guard logic stays in withCodeRifts; this module:
+ *   1. calls withCodeRifts with the same input shape,
+ *   2. maps each ProtectedTool → a framework-agnostic tool descriptor that
+ *      LangChain's tool()/StructuredTool and LangGraph's ToolNode can accept,
+ *   3. returns those descriptors PLUS the untouched assurance objects
+ *      (registry_report, composition_assurance, receipt_thread).
+ *
+ * NO hard dependency on langchain / @langchain/* / langgraph packages. The host
+ * owns the framework import and wires descriptors into tool() / ToolNode /
+ * bind_tools / StateGraph themselves.
+ *
+ * Descriptor shape (dependency-free plain object):
+ *   { name, description?, schema, func, invoke }
+ *   - schema  = JSON Schema from ProtectedTool.inputSchema (or empty object schema)
+ *   - func / invoke = the GUARDED execute (same function reference) — never the raw tool
+ *
+ * Honesty (do not "upgrade" assurance):
+ *   - composition_assurance is passed through EXACTLY as the core reported it
+ *     (COMPOSITION_CALL_POLICY_COMPLETE may still be false; inescapable_runtime may be false).
+ *   - The adapter converts tool shape + binds guarded execute; it does not claim product-level
+ *     inescapability the core does not claim.
+ *
+ * Only-protected-tools (6/D at the adapter surface):
+ *   - `tools` is derived ONLY from the frozen registry's ProtectedTool list.
+ *   - Raw tools never appear in the returned table. The host may still hold a raw
+ *     reference outside this table; that boundary stays the host's responsibility.
+ *
+ * Ergonomics (5–10 lines): pass raw tools + client + operation → LangGraph-ready descriptors.
+ * Mirrors src/adapters/openai.ts and anthropic.ts — only the target tool shape differs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.protectedToolToLangGraph = protectedToolToLangGraph;
+exports.toLangGraphTools = toLangGraphTools;
+exports.withCodeRiftsLangGraph = withCodeRiftsLangGraph;
+exports.langGraphToolAdapter = langGraphToolAdapter;
+const with_coderifts_js_1 = require("../with-coderifts.js");
+/** Empty JSON Schema object — used when a ProtectedTool has no inputSchema. */
+const EMPTY_SCHEMA = Object.freeze({
+    type: 'object',
+    properties: {},
+});
+/**
+ * Map one ProtectedTool → LangGraph/LangChain tool descriptor.
+ * Binds guarded execute to both `func` and `invoke` (same reference).
+ * Prefer tool.inputSchema when it is a plain object; otherwise empty object schema.
+ */
+function protectedToolToLangGraph(tool) {
+    const schema = tool.inputSchema != null
+        && typeof tool.inputSchema === 'object'
+        && !Array.isArray(tool.inputSchema)
+        ? tool.inputSchema
+        : { ...EMPTY_SCHEMA };
+    // Guarded execute only — never a raw unwrapped executor.
+    const guarded = (args) => Promise.resolve(tool.execute(args));
+    const out = {
+        name: tool.name,
+        schema,
+        func: guarded,
+        invoke: guarded,
+    };
+    if (tool.description != null && tool.description !== '') {
+        out.description = tool.description;
+    }
+    return out;
+}
+/**
+ * Convert a list of ProtectedTool into LangGraph/LangChain descriptors.
+ * Does NOT call the guard — pure map over an already-protected list.
+ */
+function toLangGraphTools(protectedTools) {
+    return protectedTools.map(protectedToolToLangGraph);
+}
+/**
+ * Build LangGraph/LangChain-ready guarded tool descriptors from raw tools + client + operation.
+ *
+ * Calls withCodeRifts internally (guard logic stays in the core). Returns:
+ *   - `tools` — plain descriptors { name, description?, schema, func, invoke }
+ *   - `protected_tools` — same guarded tools
+ *   - assurance objects from the core, passed through untouched
+ *
+ * @param input Same shape as withCodeRifts (WithCodeRiftsInput).
+ */
+function withCodeRiftsLangGraph(input) {
+    const core = (0, with_coderifts_js_1.withCodeRifts)(input);
+    return langGraphToolAdapter(core);
+}
+/**
+ * Shape adapter over an existing WithCodeRiftsResult (composition style).
+ * Prefer withCodeRiftsLangGraph when starting from raw tools.
+ *
+ * Does not re-run the guard; does not invent assurance.
+ */
+function langGraphToolAdapter(result) {
+    const protected_tools = result.tools;
+    const tools = toLangGraphTools(protected_tools);
+    const out = {
+        tools,
+        protected_tools,
+        registry_report: result.registry_report,
+        composition_assurance: result.composition_assurance,
+        receipt_thread: result.receipt_thread,
+    };
+    if (result.repository !== undefined) {
+        out.repository = result.repository;
+    }
+    return out;
+}
+//# sourceMappingURL=langgraph.js.map

package/dist/cjs/adapters/langgraph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"langgraph.js","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;AA2EH,4DAqBC;AAMD,4CAEC;AAYD,wDAGC;AAQD,oDAcC;AA3ID,4DAAqD;AA8DrD,+EAA+E;AAC/E,MAAM,YAAY,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC1D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,IAAmB;IAC1D,MAAM,MAAM,GACV,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;IAE1B,yDAAyD;IACzD,MAAM,OAAO,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,MAAM,GAAG,GAA4B;QACnC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO;KAChB,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,cAAwC;IACvE,OAAO,cAAc,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,sBAAsB,CAAC,KAAyB;IAC9D,MAAM,IAAI,GAAwB,IAAA,iCAAa,EAAC,KAAK,CAAC,CAAC;IACvD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAAC,MAA2B;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,GAAG,GAAiC;QACxC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cjs/adapters/openai.d.ts

@@ -0,0 +1,93 @@
+/**
+ * OpenAI tool-calling adapter over withCodeRifts (ID632 slice 1 — reference adapter).
+ *
+ * Thin SHAPE converter only. Guard logic stays in withCodeRifts; this module:
+ *   1. calls withCodeRifts with the same input shape,
+ *   2. maps each ProtectedTool → OpenAI chat.completions tool definition,
+ *   3. returns OpenAI-shaped tools PLUS the untouched assurance objects
+ *      (registry_report, composition_assurance, receipt_thread).
+ *
+ * Honesty (do not "upgrade" assurance):
+ *   - composition_assurance is passed through EXACTLY as the core reported it
+ *     (COMPOSITION_CALL_POLICY_COMPLETE may still be false; inescapable_runtime may be false).
+ *   - The adapter converts tool SHAPE for the model API; it does not claim product-level
+ *     inescapability the core does not claim.
+ *
+ * Only-protected-tools (6/D at the adapter surface):
+ *   - `tools` is derived ONLY from the frozen registry's ProtectedTool list.
+ *   - Raw tools never appear in the returned OpenAI table. The host may still hold a raw
+ *     reference outside this table; that boundary stays the host's responsibility.
+ *
+ * Ergonomics (5–10 lines): pass raw tools + client + operation → OpenAI-ready guarded tools.
+ * LangGraph / Anthropic adapters follow the same thin-converter pattern later.
+ */
+import type { WithCodeRiftsInput, WithCodeRiftsResult, CompositionAssurance, ReceiptThreadHandle } from '../with-coderifts.js';
+import type { ProtectedTool, RegistryCoverageReport } from '../tool-registry.js';
+/**
+ * OpenAI chat.completions `tools[]` element (function tool).
+ * @see https://platform.openai.com/docs/guides/function-calling
+ */
+export type OpenAIFunctionTool = {
+    type: 'function';
+    function: {
+        name: string;
+        description?: string;
+        /** JSON Schema object for the function arguments (OpenAI `parameters`). */
+        parameters: Record<string, unknown>;
+    };
+};
+/**
+ * Result of withCodeRiftsOpenAI — OpenAI tool definitions + core assurance, unflattened.
+ *
+ * `tools` is the ONLY list intended for the model/runtime tool table. `protected_tools` is the
+ * same guarded list (with execute) for host dispatch after tool_calls — never the raw tools.
+ */
+export type WithCodeRiftsOpenAIResult = {
+    /** OpenAI-shaped tools for chat.completions — only protected/guarded tools. */
+    tools: OpenAIFunctionTool[];
+    /**
+     * Guarded ProtectedTool list from withCodeRifts (same tools as `tools`, with execute).
+     * Host dispatches model tool_calls through these only. Never raw tools.
+     */
+    protected_tools: ProtectedTool[];
+    /** Untouched registry report — registry's own truth. */
+    registry_report: RegistryCoverageReport;
+    /**
+     * Product-level assurance — deliberately narrower than the registry.
+     * Passed through untouched; may still show inescapable_runtime:false and
+     * residual composition_call_policy_incomplete.
+     */
+    composition_assurance: CompositionAssurance;
+    /** Per-composition receipt cursor — NOT product-truth chain evidence. */
+    receipt_thread: ReceiptThreadHandle;
+    repository?: string;
+};
+/**
+ * Map one ProtectedTool → OpenAI function tool definition (shape only; no execute).
+ * Prefer tool.inputSchema when it is a plain object; otherwise empty object schema.
+ */
+export declare function protectedToolToOpenAI(tool: ProtectedTool): OpenAIFunctionTool;
+/**
+ * Convert a list of ProtectedTool into OpenAI tool definitions.
+ * Does NOT call the guard — pure shape map over an already-protected list.
+ */
+export declare function toOpenAITools(protectedTools: readonly ProtectedTool[]): OpenAIFunctionTool[];
+/**
+ * Build OpenAI-ready guarded tools from raw tools + client + operation.
+ *
+ * Calls withCodeRifts internally (guard logic stays in the core). Returns:
+ *   - `tools` — OpenAI chat.completions shape (function tools only)
+ *   - `protected_tools` — same guarded tools for host execute dispatch
+ *   - assurance objects from the core, passed through untouched
+ *
+ * @param input Same shape as withCodeRifts (WithCodeRiftsInput).
+ */
+export declare function withCodeRiftsOpenAI(input: WithCodeRiftsInput): WithCodeRiftsOpenAIResult;
+/**
+ * Shape-only adapter over an existing WithCodeRiftsResult (composition style).
+ * Prefer withCodeRiftsOpenAI when starting from raw tools.
+ *
+ * Does not re-run the guard; does not invent assurance.
+ */
+export declare function openAIToolAdapter(result: WithCodeRiftsResult): WithCodeRiftsOpenAIResult;
+//# sourceMappingURL=openai.d.ts.map

package/dist/cjs/adapters/openai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../src/adapters/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEjF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,2EAA2E;QAC3E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACrC,CAAC;CACH,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B;;;OAGG;IACH,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,wDAAwD;IACxD,eAAe,EAAE,sBAAsB,CAAC;IACxC;;;;OAIG;IACH,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,yEAAyE;IACzE,cAAc,EAAE,mBAAmB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAQF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,kBAAkB,CAgB7E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,GAAG,kBAAkB,EAAE,CAE5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,yBAAyB,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,GAAG,yBAAyB,CAcxF"}

package/dist/cjs/adapters/openai.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * OpenAI tool-calling adapter over withCodeRifts (ID632 slice 1 — reference adapter).
+ *
+ * Thin SHAPE converter only. Guard logic stays in withCodeRifts; this module:
+ *   1. calls withCodeRifts with the same input shape,
+ *   2. maps each ProtectedTool → OpenAI chat.completions tool definition,
+ *   3. returns OpenAI-shaped tools PLUS the untouched assurance objects
+ *      (registry_report, composition_assurance, receipt_thread).
+ *
+ * Honesty (do not "upgrade" assurance):
+ *   - composition_assurance is passed through EXACTLY as the core reported it
+ *     (COMPOSITION_CALL_POLICY_COMPLETE may still be false; inescapable_runtime may be false).
+ *   - The adapter converts tool SHAPE for the model API; it does not claim product-level
+ *     inescapability the core does not claim.
+ *
+ * Only-protected-tools (6/D at the adapter surface):
+ *   - `tools` is derived ONLY from the frozen registry's ProtectedTool list.
+ *   - Raw tools never appear in the returned OpenAI table. The host may still hold a raw
+ *     reference outside this table; that boundary stays the host's responsibility.
+ *
+ * Ergonomics (5–10 lines): pass raw tools + client + operation → OpenAI-ready guarded tools.
+ * LangGraph / Anthropic adapters follow the same thin-converter pattern later.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.protectedToolToOpenAI = protectedToolToOpenAI;
+exports.toOpenAITools = toOpenAITools;
+exports.withCodeRiftsOpenAI = withCodeRiftsOpenAI;
+exports.openAIToolAdapter = openAIToolAdapter;
+const with_coderifts_js_1 = require("../with-coderifts.js");
+/** Empty JSON Schema object — used when a ProtectedTool has no inputSchema. */
+const EMPTY_PARAMETERS = Object.freeze({
+    type: 'object',
+    properties: {},
+});
+/**
+ * Map one ProtectedTool → OpenAI function tool definition (shape only; no execute).
+ * Prefer tool.inputSchema when it is a plain object; otherwise empty object schema.
+ */
+function protectedToolToOpenAI(tool) {
+    const parameters = tool.inputSchema != null
+        && typeof tool.inputSchema === 'object'
+        && !Array.isArray(tool.inputSchema)
+        ? tool.inputSchema
+        : { ...EMPTY_PARAMETERS };
+    const fn = {
+        name: tool.name,
+        parameters,
+    };
+    if (tool.description != null && tool.description !== '') {
+        fn.description = tool.description;
+    }
+    return { type: 'function', function: fn };
+}
+/**
+ * Convert a list of ProtectedTool into OpenAI tool definitions.
+ * Does NOT call the guard — pure shape map over an already-protected list.
+ */
+function toOpenAITools(protectedTools) {
+    return protectedTools.map(protectedToolToOpenAI);
+}
+/**
+ * Build OpenAI-ready guarded tools from raw tools + client + operation.
+ *
+ * Calls withCodeRifts internally (guard logic stays in the core). Returns:
+ *   - `tools` — OpenAI chat.completions shape (function tools only)
+ *   - `protected_tools` — same guarded tools for host execute dispatch
+ *   - assurance objects from the core, passed through untouched
+ *
+ * @param input Same shape as withCodeRifts (WithCodeRiftsInput).
+ */
+function withCodeRiftsOpenAI(input) {
+    const core = (0, with_coderifts_js_1.withCodeRifts)(input);
+    return openAIToolAdapter(core);
+}
+/**
+ * Shape-only adapter over an existing WithCodeRiftsResult (composition style).
+ * Prefer withCodeRiftsOpenAI when starting from raw tools.
+ *
+ * Does not re-run the guard; does not invent assurance.
+ */
+function openAIToolAdapter(result) {
+    const protected_tools = result.tools;
+    const tools = toOpenAITools(protected_tools);
+    const out = {
+        tools,
+        protected_tools,
+        registry_report: result.registry_report,
+        composition_assurance: result.composition_assurance,
+        receipt_thread: result.receipt_thread,
+    };
+    if (result.repository !== undefined) {
+        out.repository = result.repository;
+    }
+    return out;
+}
+//# sourceMappingURL=openai.js.map

package/dist/cjs/adapters/openai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../../src/adapters/openai.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AA8DH,sDAgBC;AAMD,sCAEC;AAYD,kDAGC;AAQD,8CAcC;AAzHD,4DAAqD;AAkDrD,+EAA+E;AAC/E,MAAM,gBAAgB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,IAAmB;IACvD,MAAM,UAAU,GACd,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAE9B,MAAM,EAAE,GAAmC;QACzC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU;KACX,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,EAAE,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,cAAwC;IACpE,OAAO,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CAAC,KAAyB;IAC3D,MAAM,IAAI,GAAwB,IAAA,iCAAa,EAAC,KAAK,CAAC,CAAC;IACvD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,MAA2B;IAC3D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,GAAG,GAA8B;QACrC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cjs/final-answer-proof.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Human-readable final-answer proof block (ID645) — render layer over GuardExecutionProof.
+ *
+ * Does NOT assemble or re-decide protection. It FAITHFULLY formats a machine
+ * GuardExecutionProof (from buildExecutionProof) so an agent can embed it in a final
+ * answer without overclaiming.
+ *
+ * Honesty rules:
+ *  - currently_authorized:null → "NOT EVALUATED (SKIPPED)" — never a soft pass
+ *  - currently_authorized:false → "NOT AUTHORIZED" — never "protected/verified"
+ *  - currently_authorized:true → "AUTHORIZED" only when receipt.verified; still surfaces limits
+ *  - limits block always appears (operative non-claims)
+ *
+ * Does not modify execution-proof.ts or the proof shape.
+ */
+import type { GuardExecutionProof } from './execution-proof.js';
+export type FinalAnswerProofFormat = 'markdown' | 'plain';
+export type RenderFinalAnswerProofOptions = {
+    /**
+     * Output format. Default 'markdown'.
+     * plain = no #/* markup (still line-oriented, limits as bullet-like lines with "- ").
+     */
+    format?: FinalAnswerProofFormat;
+    /**
+     * When true (default), always include the limits / non-claims section.
+     * Setting false is allowed for ultra-compact hosts but is discouraged — the whole
+     * point of this block is honest non-overclaim.
+     */
+    includeLimits?: boolean;
+    /**
+     * Optional heading override. Default: "CodeRifts execution proof".
+     */
+    title?: string;
+};
+export type AttachProofToAgentResponseOptions = RenderFinalAnswerProofOptions & {
+    /**
+     * How to embed the rendered block.
+     *  - 'append_text' (default): append a string section to a string response, or set
+     *    `final_answer_proof` + `final_answer_proof_text` on object responses
+     *  - 'field_only': never mutate text; only attach structured fields on objects
+     *    (string responses become `{ text, final_answer_proof, final_answer_proof_text }`)
+     */
+    mode?: 'append_text' | 'field_only';
+    /**
+     * Separator before the appended block when mode is append_text and response is a string.
+     * Default: "\n\n---\n\n"
+     */
+    separator?: string;
+};
+/** Coarse human status derived only from proof fields (never invents protection). */
+export type FinalAnswerProofBanner = 'ENFORCED' | 'AUTHORIZED' | 'NOT_AUTHORIZED' | 'NOT_EVALUATED_SKIPPED' | 'PREFLIGHTED_NOT_AUTHORIZED' | 'NO_PREFLIGHT';
+/**
+ * Map proof fields → a single banner label that is visibly different for
+ * authorized / not-authorized / skipped / no-preflight.
+ */
+export declare function deriveProofBanner(proof: GuardExecutionProof): FinalAnswerProofBanner;
+/**
+ * Render a GuardExecutionProof as a compact human-readable block.
+ * Faithful to fields; never upgrades null/false authorization into "protected".
+ */
+export declare function renderFinalAnswerProof(proof: GuardExecutionProof, opts?: RenderFinalAnswerProofOptions): string;
+/**
+ * Attach a rendered proof to a host response (framework-agnostic).
+ *
+ * Convention:
+ *  - String response + append_text → `response + separator + rendered`
+ *  - Object response → shallow copy with:
+ *      final_answer_proof: GuardExecutionProof (reference; not deep-cloned)
+ *      final_answer_proof_text: string (rendered block)
+ *    and, when mode is append_text and a stringish field exists (`text` | `content` |
+ *    `message` | `final_answer`), that field is appended with the block.
+ *  - field_only never mutates string fields; wraps bare strings in an object.
+ *
+ * Hosts that only want the string can call renderFinalAnswerProof directly.
+ */
+export declare function attachProofToAgentResponse<T = unknown>(response: T, proof: GuardExecutionProof, opts?: AttachProofToAgentResponseOptions): T | (Record<string, unknown> & {
+    final_answer_proof: GuardExecutionProof;
+    final_answer_proof_text: string;
+});
+//# sourceMappingURL=final-answer-proof.d.ts.map

package/dist/cjs/final-answer-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"final-answer-proof.d.ts","sourceRoot":"","sources":["../../src/final-answer-proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAuB,MAAM,sBAAsB,CAAC;AAGrF,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,OAAO,CAAC;AAE1D,MAAM,MAAM,6BAA6B,GAAG;IAC1C;;;OAGG;IACH,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG,6BAA6B,GAAG;IAC9E;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACpC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,sBAAsB,GAC9B,UAAU,GACV,YAAY,GACZ,gBAAgB,GAChB,uBAAuB,GACvB,4BAA4B,GAC5B,cAAc,CAAC;AAEnB;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,GAAG,sBAAsB,CAYpF;AAuDD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,GAAE,6BAAkC,GACvC,MAAM,CAiGR;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,GAAG,OAAO,EACpD,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,mBAAmB,EAC1B,IAAI,GAAE,iCAAsC,GAC3C,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,kBAAkB,EAAE,mBAAmB,CAAC;IAAC,uBAAuB,EAAE,MAAM,CAAA;CAAE,CAAC,CA0C9G"}